<?php
function disable_metabox_custom_post_get_restapi ($result) {
    global $wp;

    if ( true === $result || is_wp_error( $result ) ) {
        return $result;
    }

    if ( str_starts_with($wp->request, 'wp-json/wp/v2/custom-post') && ! current_user_can('administrator')) {
        return new WP_Error(
            'wp_auth_error',
            __('Not allowed.'),
            array( 'status' => 403 )
        );
    }

    return $result;
}